Fix a parsing bug when specifying more than one address with dotted decimal

netmask.

Reported by:	Igor Anishchuk
PR:		kern/107565
MFC after:	3 days

1 files changed, 8 insertions, 2 deletions

diff --git a/sbin/ipfw/ipfw2.c b/sbin/ipfw/ipfw2.c
index 35c579c..cd640d2 100644
--- a/sbin/ipfw/ipfw2.c
+++ b/sbin/ipfw/ipfw2.c
@@ -2763,13 +2763,17 @@ fill_ip(ipfw_insn_ip *cmd, char *av)
 	 * ',' indicating another address follows, '{' indicating a
 	 * set of addresses of unspecified size.
 	 */
-	char *p = strpbrk(av, "/:,{");
+	char *t = NULL, *p = strpbrk(av, "/:,{");
 	int masklen;
-	char md;
+	char md, nd;
 
 	if (p) {
 		md = *p;
 		*p++ = '\0';
+		if ((t = strpbrk(p, ",{")) != NULL) {
+			nd = *t;
+			*t = '\0';
+		}
 	} else
 		md = '\0';
 
@@ -2803,6 +2807,8 @@ fill_ip(ipfw_insn_ip *cmd, char *av)
 		break;
 	}
 	d[0] &= d[1];		/* mask base address with mask */
+	if (t)
+		*t = nd;
 	/* find next separator */
 	if (p)
 		p = strpbrk(p, ",{");